I'll be honest this is painful so far every upgrade from kibana 7.1 to 7.11.1 has resulting in something going wrong 1 prod cluster and 2 dev clusters. Seems I just have terrible luck. All index's have been default for months now due to not having time to correct changes between versions.
Test node for this case is a stand alone with all roles including transform.
Some people have luck getting Kibana 7.11.1 to even start. Most people failure's have been Fleet which is not the only case for me.
Upgraded 7.10.2 to 7.11.0 -- Failed had to roll back due to fleet bug. All was fine
Waited a few days. Upgraded from 7.10.2. to 7.11.1 -- Total failure leaving me with dozens of issues.
First one:
Upgrade to 7.11.1 has resulted in Kibana not doing anything at all. The service starts but generates 0 log's and it's configured for verbose logging and never presents a web page. It's a dead services. Even journctl show 0 events just services started. I let it sit for 9+ hours in this state and it never changed. Did the basics restarted the server checked for none existing logs. Troubleshooting a failed start at this point is not really possible. Only option downgrade.
Downgrade results to 7.11.0 "repo version" is a total bust for Fleet but at least it starts now.
And then...
[illegal_argument_exception] updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged response from /_component_template/logs-endpoint.events.file-mappings: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged"}],"type":"illegal_argument_exception","reason":"updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged","caused_by":{"type":"illegal_argument_exception","reason":"template [logs-endpoint.events.file] has alias and data stream definitions"}},"status":400}
Refreshing the page will give me 1 of 6 different errors so it's hard to pin point what it is. Any tips on how to fix this and not have it happen again.